iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
GhostAction is an ongoing GitHub supply-chain campaign in which attackers use stolen developer credentials to add apparently routine GitHub Actions workflows, search repositories and Git history for secrets, and send findings to attacker-controlled infrastructure. In the October 8–9, 2026 burst, GitGuardian reported more than 30,000 repositories targeted across 3,000 users and organizations, about 1,900 compromised GitHub accounts, and 3,174 attempted secret extractions from public-repository CI.
Those figures describe attempted targeting and account compromise, not 30,000 confirmed breaches. Earlier observations show that GitHub approval controls, workflow blocking, and repository configuration determined whether an injected workflow actually ran.
What GhostAction is
GhostAction is the name used for a continuing campaign against GitHub users and repositories. The activity was first documented in September 2025 and continued through multiple waves in 2026. Rather than poisoning a package that downstream developers install, the attackers obtain write access to repositories by taking over legitimate GitHub identities. They then commit malicious workflow files under those identities, making the changes appear to come from a trusted maintainer.
Free tools Windows power users keep installed
One-click scans. No signup required.
The stolen access included personal access tokens and other GitHub credentials obtained from infostealer logs or credential dumps. A usable token can let an attacker create or modify workflow files without needing to compromise the build server directly.
#1 Best Overall
- Requires 3 "AAA" batteries (included)
- Unit auto-locks for 30 minutes after 5 consecutive incorrect PINs
How the October 2026 wave operated
1. Stolen credentials enabled repository writes
After acquiring a developer’s GitHub credential, the attackers used it to access repositories and commit workflow files. This direct-write approach differs from a dependency attack: the malicious code enters the victim’s own automation configuration and is associated with a real account.
2. Benign-looking workflow names concealed the payload
Observed files included names such as security-audit.yml and security-check.yml. Commit messages such as Add security check workflow and Update Github Actions Security workflow were designed to blend into normal maintenance activity. A review that checks only the filename or commit author can therefore miss the compromise.
Rank #2
- Auto-Fill Feature: Say goodbye to the hassle of manually entering passwords! PasswordPocket automatically fills in your credentials with just a single click.
- Internet-Free Data Protection: Use Bluetooth as the communication medium with your device. Eliminating the need to access the internet and reducing the risk of unauthorized access.
- Military-Grade Encryption: Utilizes advanced encryption techniques to safeguard your sensitive information, providing you with enhanced privacy and security.
- Offline Account Management: Store up to 1,000 sets of account credentials in PasswordPocket.
- Support for Multiple Platforms: PasswordPocket works seamlessly across multiple platforms, including iOS and Android mobile phones and tablets.
3. The workflow searched present and historical content
Early payloads searched repository files for credential patterns. Later variants also inspected the full Git history, including values that had been deleted from the current branch but remained in earlier commits. The October versions added context around AWS key IDs and expanded history scanning.
Findings were sent to attacker infrastructure. The October 2026 wave used the bare IP address 193.32.204.199 over HTTP, an indicator defenders can search for in workflow files, logs, proxy records, and network telemetry.
Rank #3
- NEVER FORGET A PASSWORD AGAIN: Almost every App. has a password, it is almost impossible to remember all the password log in details. This password book is specifically designed to help you create secure passwords and store all your passwords safely in one place. You will never forget your password log-in details again with this password keeper.
- ALPHABETICAL A-Z TABS FOR QUICK ACCESS: Alphabetical tabs design allows you to store your passwords alphabetically so you can find what you want faster, no more annoying searches!
- ANONYMOUS WITHOUT ANY TITLE: On the outside, this password notebook organizer looks just like those writing journals, there is no title listed on the cover, so no one would know it's a password book. But we still recommend keeping the internet password logbook in a safe place such as a locked drawer or a shelf full of books.
- THICK NO-BLEED PAPER: This 5.2" x 7.6" password book contains 74 sheets of thick 120gsm paper that resists ink smearing, say goodbye to those cheap password books that bleed ink!
- PREMIUM QUALITY & PERFECT MEDIUM SIZE: This password journal comes with a high-quality leatherette hardcover, an elastic band, pen holder, ribbon bookmarker, and inner accordion pocket. It measures 5.2 inches wide and 7.6 inches long, which is the perfect size for your needs.
Campaign scale and timeline
| Period | Observed activity | Secret activity |
|---|---|---|
| September 2025 | 817 public repositories across 327 GitHub users | At least 3,325 secrets exfiltrated |
| August 31–September 30, 2026 | 772 public repositories across 373 users and organizations injected | 2,577 secrets targeted; categories included SSH private keys and deployment credentials (446), Azure credentials (218), container-registry credentials (142), database credentials (112), AWS access keys (106), FTP credentials (92), Google Cloud/Firebase credentials (80), and GitHub tokens (66) |
| October 8–9, 2026 | More than 30,000 repositories across 3,000 users and organizations; about 1,900 GitHub accounts compromised | 3,174 attempted extractions from public-repository CI |
| October 9, 2026 onward | GitHub began preventing the malicious workflow from running | GitGuardian reported that injections observed on October 10 and October 12 could not extract secrets |
Gaetan Ferry and Guillaume Valadon of GitGuardian summarized the October burst as follows: “In total, our dataset shows the threat actor targeted more than 30,000 repositories across 3,000 users and orgs. This resulted from compromising the GitHub accounts of about 1,900 users. It attempted to extract 3,174 secrets from public repositories’ CI.”
Injection is not the same as execution
A malicious workflow appearing in a repository proves that an attacker obtained write access, but it does not prove that the workflow ran or that a secret left the environment. GitHub may hold a new workflow for approval, repository settings may restrict execution, and later platform blocking can stop known payloads.
Rank #4
- NEVER FORGET A PASSWORD AGAIN - Clever Fox password journal will help you create secure passwords and keep them safe and organized. This password book allows you to store all your passwords and other computer information in one place to find it easily.
- ALPHABETICAL A-Z TABS - Alphabetic tab system makes it easy to find any password you need. The book also has sections for most important passwords, wireless & email settings, software license information & additional notes.
- ELEGANT, SMART, PRACTICAL & SECURE PASSWORD ORGANIZATION - This password keeper book has been designed to be anonymous without an obvious title on the cover. For added security there is space to write hints instead of the password itself.
- POCKET SIZE & PREMIUM QUALITY - This internet address and password logbook with tabs comes in pocket size (4.0x5.5 inches). The password notebook has an eco-leahter hardcover, elastic band, pen loop, bookmark, pocket for notes, and thick 120gsm paper.
- 60-DAY MONEY-BACK GUARANTEE - We will exchange or refund your password organizer if you aren’t satisfied with your password organization for any reason. Reach out to us via message to refund your internet password logbook.
| Measure | August–September 2026 wave |
|---|---|
| Repositories with observed workflow runs | 605 |
| Total observed workflow runs | 3,669 |
| Runs that executed | 499 in 32 repositories |
| Runs that completed successfully | 336 |
| Repositories with secrets exfiltrated | 13 |
| Secrets exfiltrated | 26 |
| Repositories effectively cleaned by October 5 | 124, or 16% of the observed public history |
The smaller confirmed-exfiltration count does not make an injected workflow harmless. It indicates that execution controls affected the outcome and that defenders must investigate both repository changes and workflow-run history.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Why Git history changes the risk
Scanning Git history shows that the campaign was not limited to credentials visible in the current public files. A key, database password, deployment token, or package-publishing credential can remain recoverable in an old commit after a maintainer deletes it from the latest version. If the repository’s workflow can read that history, the old value may still be exposed.
Best Value
- Securely Remember All Your Passwords, Log-in's, User Names, ATM PIN Numbers and More
- Large Back-lit LCD Screen, QWERTY Keyboard - So Easy to Use
- Enter one PIN number and have access to 400 accounts. Search function included.
- Unit auto locks for 30 minutes after 5 consecutive incorrect PIN attempts
- Includes mini stylus for easier keypad entry
Some victims were hit in earlier waves, which suggests that credentials were not always rotated after the first incident. A second compromise can therefore succeed with an old GitHub token or with downstream secrets that were believed to have been removed. GitGuardian also observed victims later involved in separate cryptomining campaigns; a reused credential can be exploited by multiple actors, so every later action should not automatically be attributed to GhostAction.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What to do after a suspicious workflow appears
- Preserve evidence first. Record the commit SHA, author, workflow file, workflow-run IDs, timestamps, logs, and relevant network or CI records. Do not delete the only copy before collecting evidence.
- Review GitHub audit logs. Look for unexpected workflow creation or modification, repository changes, unfamiliar token use, new authentication events, and activity from the affected account. Check organization and repository audit records where available.
- Search current files and history. Look for
security-audit.yml,security-check.yml, the commit-message patterns used by the campaign, the endpoint193.32.204.199, and credential-pattern matches. Search every branch and Git history, not only the default branch. - Remove the malicious workflow. After evidence is preserved, delete the file and any related jobs, actions, branches, or scheduled triggers. Confirm that no pending or completed run can execute again.
- Revoke the credential that enabled the write. Revoke the compromised personal access token, OAuth token, SSH credential, or other GitHub account credential. Removing downstream secrets without revoking this enabling credential leaves the attacker able to re-enter and make new changes.
- Rotate every exposed secret. Replace cloud, container-registry, database, FTP, CI/CD, deployment, package-publishing, chat-bot, and other credentials found in current files, logs, artifacts, or historical commits. Treat a value found only in Git history as exposed.
Controls that reduce repeat compromise
- Require multifactor authentication for GitHub users, preferably with phishing-resistant FIDO2 or WebAuthn security keys for privileged maintainers.
- Use short-lived, narrowly scoped tokens and review token permissions regularly.
- Require review or approval for new and modified workflows, particularly in repositories where workflows can access secrets.
- Enable secret scanning and push protection, and alert on credentials committed to any branch. GitHub announced context-aware AI secret detection for secret-scanning alerts and push protection, with some capabilities in preview on October 7, 2026.
- Limit the secrets exposed to each job, pin third-party actions to reviewed versions, and prevent untrusted pull-request code from receiving production credentials.
- Monitor audit logs and workflow changes centrally so a maintainer’s account cannot silently add automation across many repositories.
What the numbers mean for defenders
The October headline is a measure of reach: more than 30,000 repositories were targeted after about 1,900 accounts were compromised. It is not a claim that every repository ran the payload or lost a secret. The August–September execution data demonstrates the distinction, while the history-scanning behavior means that a repository with no obvious current secret can still require full credential rotation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
